"Cannot communicate with the policy enforcement service" error when trying to enable Target on a datastream

Hi all. Hoping someone can help me with this strange issue I'm encountering. I don't know if this is a bug I should be calling Support over, or if I'm just going about this wrong process-wise.

• The problem: 
  • I'm getting this error when trying to enable Target on a datastream in my staging and production sandboxes, but not my development sandbox: "An error occurred while saving the datastream. Cannot communicate with the policy enforcement service. Try again later."
    

• The context:
  • I am using tags and the Web SDK to implement CJA (through Experience Platform) and Adobe Target, and am trying to set up separate datastreams to cover each of my web environments.
  • I have separate sandboxes set up for my three envs, so I need to set up a datastream on each one:
    • Development (dev)
      • (This is the only sandbox that lets me enable Target on a datastream without error)
    • Staging (dev)
    • Production (prod, default)

• The process:
  • I am closely following this tutorial on implementing Target using Web SDK. Stuck at the "Configure Datastream" step when it comes to my Staging and Production sandboxes.
• What I've checked:
  • Permissions
    • The role I'm using to grant myself access to the "Manage Datastreams" and related prerequisite permissions also gives me access to all sandboxes, so it's not a gap in feature/sandbox access.
      
      
      
    • "Policy enforcement service" is mentioned in the error message so it may have something to do with Data Governance, but there are no governance policies enabled on any of my sandboxes and my permissions should give me full access to all Governance features anyway.
    • I have an Approver role in the Target workspace whose environments I'm trying to connect to
      

       

  • Target environment config
    • I've double/triple-checked the Environment IDs I am providing; there's no error here.
    • The problem seems to exist at the sandbox level: providing these environment IDs on the datastream will succeed on the Development sandbox, but fails on all other sandboxes.